我有一个旧的.net站点(使用.net 4.6),当用户从一页转到另一页时,该站点在cookie中存储了一些临时值。该站点只能在我们公司的内部网络上访问,并且仅使用HTTP。当前是流程:
Page 1 -> Creates the cookie. Stores session token.
Page 2 -> Adds receipt id to cookie (happens in .net code - see below)
Page 3 -> Reads receipt id from cookie and does something with it.
这一切在Chrome将SameSite=Lax
设置为默认值之前就可以使用。我进行了测试,并且如果我禁用了chrome://flags/#same-site-by-default-cookies
(本质上设置了SameSite=None
),则第2页可以成功更新cookie,一切正常。没有SameSite=None
,Page2无法更新cookie,因此Page 3无法使用它(cookie实际上不会更新)。
设置Cookie的代码:
/// <summary>
/// This function is used to update UserCookieWrapper values
/// </summary>
/// <param name="item">Can be a stirng</param>
/// <param name="val">Can be a string</param>
/// <param name="expireHours">Must be a double</param>
private static void UpdateCookieVal(COOKIE_ITEM item, string val, double expireHours){
//get the existing cookie (or new if not exists)
HttpCookie cookie = GetAppCookie(true);
//modify its contents & meta.
if(RememberMe)
cookie.Expires = DateTime.Now.AddHours(clsBLLConstants.APP_COOKIE_EXIPRYHOURS);
cookie.Values[item.ToString()] = clsEncryption.EncryptPassword(val, clsBLLConstants.initVector, clsBLLConstants.saltValue, clsBLLConstants.passPhrase, clsBLLConstants.hashAlgorithm, clsBLLConstants.passwordIterations, clsBLLConstants.keySize);
//add back to the http response to send back to the browser
HttpContext.Current.Response.Cookies.Add(cookie);
try
{
HttpContext.Current.Response.Cookies.Add(cookie);
} catch (Exception exception) {
clsBLLErrorHandler.WriteError(exception);
}
}
问题: